Remove non-environment Actions secrets from this repository

[HonkingGoose]

Describe the proposed change(s).

Quote from @rarkins ¹:

I think the best thing would be for us to remove all secrets from this repository so that we can be more "generous" with write access.

Footnotes

1. https://github.com/renovatebot/renovate/issues/7927#issuecomment-954385272 ↩

[rarkins]

We have the following Actions secrets:

Repository:

• Codecov token: I think we can leave this, because there's nothing catastrophic if it leaks
• Semantic release uses a GitHub PAT to publish releases and an npm token to publish to npmjs
• The WhiteSource scanner uses a token that we are ok with leaving in

Org-wide:

• We have a docker username/password which every repo inherits, but this repo doesn't need

The other possibility is that the release secrets (npm, github PAT, Docker) are isolated to GitHub Environments. However, I'm not certain if this is appropriate (it didn't seem to be the first time I ever looked into them). That way they're not removed from the repository but it should mean that they are at least protected using Branch protection, which reduces our risk.

Cc @JamieMagee @viceice

[viceice]

Codecov is not used and can be removed.

I think we can use the buildin GITHUB_TOKEN to publish to github releases now, so no need for a GitHub PAT.

This works fine at https://github.com/containerbase/buildpack

So we only need the npm token in this repo.

[viceice]

@rarkins We can switch all our docker images to only publish to ghcr.io with GITHUB_TOKEN then we create a single repo to sync from ghcr to hub.

[HonkingGoose]

What's the progress on this issue?